#pragma once

class CNTHook
{
public:
    enum E_HOOK_FUN 
    {
        ZwGetContextThread = 0,                 //0x55
        ZwSetContextThread,                     //0xD5
        ZwQueryVirtualMemory,                   //0xB2
        ZwReadVirtualMemory,                    //0xBA
        ZwWriteVirtualMemory,                   //0x115
        ZwMax
    };
public:
    CNTHook(void);
    ~CNTHook(void);
    bool Hook(HANDLE hThread);
    bool UnHook(HANDLE hThread);
    bool LoadHandler();

private:
    DWORD mAryFun[ZwMax];
    static DWORD mKiSystemCall, mKiSystemCallRet;
    HANDLE mHcall, mHret;
    static LONG WINAPI VectoredHandler(PEXCEPTION_POINTERS ExceptionInfo);
    static HANDLE mHVH;
};
